Ousted WhatsApp Security Exec Sues Meta After Whistleblowing (1)

A former WhatsApp employee alleges Meta Platforms Inc. fired him in February because of whistleblowing and escalating privacy and cybersecurity concerns up to its CEO.

Attaullah Baig was fired less than two months after telling CEO Mark Zuckerberg he’d tipped off the Securities and Exchange Commission and one month after informing Meta he’d filed a retaliation complaint with the Department of Labor’s Occupational Safety and Health Administration, according to his lawsuit filed Monday in the US District Court for the Northern District of California.

Baig, who said he was head of security at WhatsApp, claims he was let go under the guise of “poor performance,” but the real reason was allegedly the culmination of years of threats from bosses over his reporting. He flagged compliance failures and cybersecurity issues that gave 1,500 WhatsApp engineers “unrestricted access to user data” and allowed account takeovers affecting 100,000 users “daily.”

The whistleblower said he’d first “discovered systemic cybersecurity failures” in 2021, shortly after joining WhatsApp as head of security. That included the flouting of federal securities laws and a Federal Trade Commission order which required then-Facebook to pay a $5 billion civil penalty and heighten privacy protections. Baig also saw what he thought were several Sarbanes Oxley Act violations.

An attorney for Baig at nonprofit Psst.org, Jennifer Gibson, said she couldn’t think of another company with as many whistleblowers as Meta.

“Meta had a choice: They could fix the problems or attack the messenger, and they chose the latter,” she said.

Zuckerberg Letters

In January 2024, Baig sent Zuckerberg, who is listed as a defendant along with Meta, and Meta’s general counsel a letter documenting alleged 2020 FTC order and SEC rules violations. He pleaded “that the central security team had falsified security reports to cover up decisions not to remediate data exfiltration risks” and that such falsifications could lead to criminal penalties.

Meta purportedly blocked features he and his team built to mitigate user harm. Come November 2024, Baig filed an SEC form “documenting Meta’s cybersecurity deficiencies and failure to inform investors about material cybersecurity risks.” He allegedly sent Zuckerberg another letter that December, disclosing the alleged continuation of cybersecurity issues, escalated retaliation, and the form’s filing.

“Sadly this is a familiar playbook in which a former employee is dismissed for poor performance and then goes public with distorted claims that misrepresent the ongoing hard work of our team,” Carl Woog, VP of Global Communications at WhatsApp, said in an email.

Another WhatsApp spokesperson, Zade Alsawah, disputed the title “head of security” used by Baig. “He was hired, and exited, at WhatsApp as a level 1 software engineering manager, with multiple Directors above him reporting into VP of Engineering overseeing this work,” Alsawah said.

Gibson sent Bloomberg Law emails from Meta employees in which he was referred to as head of security, and a press release.

Alsawah said that the DOL dismissed Baig’s aforementioned complaint.

Baig’s lawsuit says OSHA actions filed before and after his termination were consolidated, more than 180 days have passed since his first “without a final decision,” and so he was removing his SOX allegations to federal court.

Baig wants reinstatement with the same seniority status that he’d have had barring discrimination, back pay, and compensation for special damages and “for emotional distress, mental anguish, and other consequential damages.”

Schonbrun Seplow Harris Hoffman & Zeldes LLP also represents Baig.

The case is Baig v. Meta Platforms, Inc., N.D. Cal., No. 3:25-cv-07604, complaint filed 9/8/25.